CVE-2025-12404 Overview
CVE-2025-12404 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the Like-it plugin for WordPress in all versions up to and including 2.2. The flaw stems from missing or incorrect nonce validation in the likeit_conf() function. Unauthenticated attackers can forge requests that update plugin settings and inject malicious web scripts when a site administrator is tricked into clicking a crafted link. The vulnerability is categorized under [CWE-352] Cross-Site Request Forgery. Because the injected content executes in the administrator's browser context, the impact extends beyond configuration tampering to stored script injection against the WordPress admin interface.
Critical Impact
Unauthenticated attackers can modify plugin configuration and inject persistent JavaScript into a WordPress site by luring an authenticated administrator to a malicious link.
Affected Products
- WordPress Like-it plugin versions up to and including 2.2
- WordPress installations with the Like-it plugin active
- Administrator sessions interacting with untrusted links while authenticated
Discovery Timeline
- 2025-11-18 - CVE-2025-12404 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12404
Vulnerability Analysis
The Like-it plugin exposes a configuration handler, likeit_conf(), that processes settings updates submitted from the plugin's administration page. The handler does not verify a WordPress nonce token before applying submitted values. WordPress nonces are the framework's built-in CSRF countermeasure and must be validated using functions such as check_admin_referer() or wp_verify_nonce() on any state-changing request.
Because likeit_conf() accepts input without proving the request originated from the legitimate admin form, any HTTP request sent while an administrator is authenticated will be honored. The plugin then persists the submitted values into WordPress options and renders them back into the configuration template at tpl/config.php. Since the stored values are echoed without sufficient output encoding, an attacker can seed the settings with JavaScript payloads that execute whenever the configuration page is loaded.
Root Cause
The root cause is the absence of nonce validation on a privileged action handler. The likeit_conf() function trusts the presence of an authenticated session as sufficient authorization, ignoring the requirement that the request also demonstrate intent originating from the WordPress admin UI.
Attack Vector
Exploitation requires an attacker to craft a malicious HTML page or link containing a form or image that submits to the vulnerable plugin endpoint. When a logged-in WordPress administrator visits the attacker-controlled resource, the browser transmits session cookies with the forged request, and the plugin applies the attacker's chosen configuration. Injected script payloads then execute in the administrator's authenticated context on subsequent visits to the configuration page. See the Wordfence Vulnerability Report and the affected WordPress Plugin Template Code for further technical detail.
Detection Methods for CVE-2025-12404
Indicators of Compromise
- Unexpected changes to Like-it plugin options stored in the wp_options table, particularly outside routine administrative maintenance windows.
- Presence of <script> tags, event handlers, or JavaScript URI schemes within Like-it configuration values.
- Admin-panel page loads that trigger outbound requests to unfamiliar third-party domains after visiting the plugin configuration screen.
Detection Strategies
- Review web server access logs for POST requests to the Like-it configuration endpoint that lack a valid HTTP Referer matching the site's wp-admin origin.
- Inspect the rendered configuration page for HTML characters that were not encoded, indicating injected markup persisted by an attacker.
- Compare plugin option values against a known-good baseline after plugin installation or upgrade.
Monitoring Recommendations
- Enable WordPress audit logging to record option changes and correlate them with authenticated administrator sessions.
- Alert on outbound network connections initiated from browsers loading wp-admin pages to identify script-driven exfiltration attempts.
- Monitor for new or modified administrator accounts, plugin installations, and theme edits that could follow a successful CSRF-driven compromise.
How to Mitigate CVE-2025-12404
Immediate Actions Required
- Deactivate the Like-it plugin on all WordPress sites until a patched release above version 2.2 is confirmed available and installed.
- Audit current plugin configuration values and remove any entries containing HTML or JavaScript content.
- Force administrator session invalidation and rotate credentials if suspicious configuration changes are found.
Patch Information
At the time of publication, the vendor references point only to source at like-it.php line 130 and line 131 in version 2.2. Administrators should monitor the plugin's WordPress.org listing and the Wordfence Vulnerability Report for a fixed release that adds nonce verification to likeit_conf() and output encoding in tpl/config.php.
Workarounds
- Restrict access to /wp-admin/ using IP allowlisting or a VPN so that CSRF requests cannot reach administrator browsers on untrusted networks.
- Deploy a web application firewall rule that blocks POST requests to the Like-it configuration endpoint lacking a same-origin Referer header.
- Require administrators to use a dedicated browser profile for WordPress administration to limit exposure to attacker-controlled tabs.
- Replace the Like-it plugin with an alternative that provides equivalent functionality with maintained security updates.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
